Group Policy states that automatic updates are DISABLED but it still installed them anyway. It installed the May 2021 cumulative on one of my Server 2019 systems.

You need to dig through the Task Scheduler to find the things that check for updates or turn the disabled options back on. A lot of these tasks are under the SYSTEM or TrustedInstaller security context and/or execute in Session 0, so they are not visible to a regular logged in user, even one in the Administrators group.

Also wanted to add, I have a theory that you could point your computer to a WSUS with no updates in it to prevent updates.

15 hours ago, Tripredacus said:

 Also wanted to add, I have a theory that you could point your computer to a WSUS with no updates in it to prevent updates.

or set wsus server to anything non existing on gpo. For example stupid.update.stop as wsus server name. It will error out as no connection. I used it once to stop updates on win10 to one client (was required not to update automatically at any case while still have networking)

That sounds like a better idea that to have to determine what you want your empty WSUS to be, physical or a VM.

Sue them and win would be a better solution . Imagine you run an important business or a real "organisation".

This is what I do when updates are defiantly going on in the background. It prevents the installation of servicing stacks as well. Just keep in mind that you did this so you aren't scratching your head later when updates don't work.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tiworker.exe]
"Debugger"=">nul 2>&1"

 

I'm almost sure the settings will revert back after an update or by themselves.